Pass a moving tag that is behind main only by CI commits

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to `laranail/package-tools` are documented in this file.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Fixed
+
+- `scripts/verify-tag-currency.sh` now passes a single-moving-tag package whose tag is behind `main` only by commits that touch `.github/`, as it already did for released packages. Those commits ship nothing, and Dependabot adds one weekly, so every moving-tag package's scheduled check went red on a workflow bump.
+
 ## [0.1.6] - 2026-10-05
 
 ### Changed

scripts/verify-tag-currency.sh

@@ -86,12 +86,15 @@ tag_commit() {
   fi
 }
 
-# A package on the moving-tag model holds exactly one v* tag and moves it. A package that has cut
-# a second tag is on real releases, and a published release is immutable: moving it hands consumers
-# who already resolved it different code under the same name. Such a tag falls behind main whenever
-# main gains a commit, which Dependabot does weekly. A commit that touches only .github/ ships
-# nothing (the directory is export-ignored), so it is not unreleased code and must not turn the
-# check red. Called after ${tags} is read.
+# A commit that touches only .github/ ships nothing (the directory is export-ignored), so it is not
+# unreleased code: a tag behind main by such commits still hands consumers exactly what main would.
+# Dependabot adds one weekly, so without this every package's scheduled check would go red on a
+# workflow bump. That holds for both tag models.
+#
+# When shipped code IS behind, the advice differs. A package on the moving-tag model holds exactly
+# one v* tag and moves it. A package that has cut a second tag is on real releases, and a published
+# release is immutable: moving it hands consumers who already resolved it different code under the
+# same name, so it gets a new patch instead. Called after ${tags} is read.
 released() { [ "$(printf '%s\n' "${tags}" | grep -c .)" -gt 1 ]; }
 
 ci_only() {
@@ -182,8 +185,8 @@ if [ "${commit}" = "${head}" ]; then
       ok "${highest} is also on ${BRANCH}."
     else
       hbehind=$(gh api "repos/${REPO}/compare/${hcommit}...${head}" --jq '.ahead_by' 2>/dev/null || echo '?')
-      if released && ci_only "${hcommit}"; then
-        ok "${highest} is a release; the ${hbehind} commit(s) since it touch only .github/."
+      if ci_only "${hcommit}"; then
+        ok "${highest} is behind ${BRANCH} only by ${hbehind} commit(s) that touch only .github/."
       else
       fail "${highest} is the highest tag and is ${hbehind} commit(s) behind ${BRANCH}. An unconstrained \`composer require ${REPO}\` resolves it, so it must be current or it must not exist."
       fi
@@ -197,12 +200,10 @@ else
     --jq '.commits[] | "    " + .sha[0:8] + "  " + (.commit.message | split("\n")[0])' 2>/dev/null || true
   echo
 
-  if released; then
-    if ci_only "${commit}"; then
-      ok "${current} is a release; the commits since it touch only .github/, so nothing a consumer installs is unreleased."
-    else
-      fail "${current} is behind ${BRANCH}. It is a published release, so do not move it: cut ${current%.*}.$(( ${current##*.} + 1 ))."
-    fi
+  if ci_only "${commit}"; then
+    ok "${current} is behind ${BRANCH} only by commits that touch only .github/, so nothing a consumer installs is unreleased."
+  elif released; then
+    fail "${current} is behind ${BRANCH}. It is a published release, so do not move it: cut ${current%.*}.$(( ${current##*.} + 1 ))."
   else
     fail "${current} is behind ${BRANCH}. Move it (git tag -f ${current} ${BRANCH} && git push --force origin ${current}) or cut a new one."
   fi

tests/Feature/VerifyTagCurrencyScriptTest.php

@@ -37,9 +37,16 @@ function runTagCurrency(array $env): Process
         ->and($process->getOutput())->not->toContain('git tag -f');
 })->skipOnWindows();
 
-it('still asks a moving-tag package to move its tag', function (): void {
+it('passes a moving-tag package whose later commits touch only .github/', function (): void {
     $process = runTagCurrency(['STUB_TAGS' => 'v0.1.0', 'STUB_TAG_SHA' => 'aaa', 'STUB_HEAD' => 'bbb', 'STUB_FILES' => '.github/workflows/ci.yml']);
 
+    expect($process->getExitCode())->toBe(0)
+        ->and($process->getOutput())->toContain('touch only .github/');
+})->skipOnWindows();
+
+it('still asks a moving-tag package to move its tag when shipped code changed', function (): void {
+    $process = runTagCurrency(['STUB_TAGS' => 'v0.1.0', 'STUB_TAG_SHA' => 'aaa', 'STUB_HEAD' => 'bbb', 'STUB_FILES' => 'src/Foo.php']);
+
     expect($process->getExitCode())->toBe(1)
         ->and($process->getOutput())->toContain('Move it');
 })->skipOnWindows();